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ABSTRACT 



The Naval Postgraduate School’s Space Systems Academic Group is 
developing a satellite-based experiment to evaluate the electrical properties 
of ferroelectric capacitors under high levels of ionizing particle radiation. 

The experiment, called FERRO, is one of three experiments that comprise 
the APEX mission. The Apex mission is sponsored by the joint Space Test 
Program and will be launched in early 1993. The main processor for FERRO 
is an Intel 80C196KB 16-bit embedded controller that will perform all 
aspects of experiment control, data acquisition, and communication with the 
host satellite processor. The design of systems and communications 
software to support the experiment is presented. Functional areas 
addressed by the design include: microcontroller and peripheral 
initialization; communication between the experiment and spacecraft 
processors; fault detection/recovery; recovery from loss of power; and 
development of an IBM PC based program to provide for pre-flight 
verification and testing of experiment hardware and software. 
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I. 



INTRODUCTION 



A. PURPOSE 

The Naval Postgraduate School's Space Systems Academic Group is 
developing a satellite-based experiment to evaluate the electrical properties 
of ferroelectric capacitors in a space environment. Although ferroelectric 
devices have undergone radiation testing in artificial environments, actual 
testing in space is necessary to assure the suitability of these devices for 
space applications. The purpose of this thesis is to develop microcontroller 
software to conduct the experiment, collect data, and provide for 
communication between the spacecraft and experiment processors. 

B. BACKGROUND 

1. APEX Mission 

The experiment, called FERRO, is scheduled for launch aboard a 
joint Department of Defense (DOD) spacecraft in March 1993. FERRO is 
one of three independent experiments that make up the Advanced 
Photovoltaic and Electronics Experiment (APEX) mission. The mission is 
sponsored by the joint Space Test Program under the management of the 
U.S. Air Force. 

The objective of the APEX mission is to collect data concerning 
the effects of a high radiation environment on selected electronic 
components. To meet this objective, three experiments will be placed in a 
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low-earth, near-polar orbit for a minimum mission life of one year and a goal 
of three years. 

The principal experiment is the Photovoltaic Array Space Power 
Plus Diagnostics (PASP-PLUS) developed by the NASA/Goddard Space 
Flight Center. PASP-PLUS will determine the efficiency and performance 
limits of advanced solar cell designs under stressing space environments. 
Second, is the Cosmic Ray Upset Experiment (CRUX) developed by the Air 
Force Geophysics Laboratory. CRUX will develop data to validate and 
update analytical models used to determine the effects of high energy 
cosmic rays and trapped protons on space-borne semiconductor 
components. FERRO is the third and smallest of the experiments and will 
determine the performance of ferroelectric capacitor test devices exposed to 
long periods of radiation and high stressed operation. 

The APEX spacecraft (Figure 1) is based on the PegaStar 
integrated spacecraft bus for the Pegasus launch vehicle developed by 
Orbital Sciences Corporation (OSC). Integration and system level testing of 
the bus, launch vehicle, and APEX subsystems will take place at OSC’s 
Systems Integration Laboratory at NASA Ames-Dryden Flight Research 
Facility [Ref. 1]. 

The APEX spacecraft will be placed in a polar elliptical orbit with a 
target inclination of 70°, + 10°/-0° that will provide periodic exposure to 
the lower Van Allen radiation belt. Target parameters for initial perigee and 
apogee were selected to provide a 190 ±10 nmi perigee and a 1054 ±100 
nmi apogee over the mission lifetime. [Ref. 1: p. 16] 
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Figure 1. APEX Spacecraft and Payload Layout [Ref. 1] 
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2. Ferroelectric Devices 



A ferroelectric material is one that is polarized by the application 
of an electric field and that maintains a remanent polarization after removal 
of the exciting field. Early bulk or thick-film ferroelectric devices required 
excessive voltages to switch polarization states, but recent advances in 
thin-film technology have made the use of ferroelectric devices practical. 

Thin-film ferroelectric capacitors have been the subject of 
considerable research over the past decade due to the highly desirable 
properties these devices exhibit with respect to memory applications. These 
properties include nonvolatility, radiation-hardness, low power consumption, 
high speed, high switching endurance, and high component density. 

Ferroelectric devices have significant advantages over 
conventional nonvolatile semiconductor memory technology in many of 
these areas and this superiority makes ferroelectric memory a natural choice 
for space-borne and military applications as well as for more conventional 
commercial applications. [Ref. 2] 
a. Bistable Polarization 

A basic characteristic of ferroelectric capacitors is the 
hysteretic behavior relating polarization, P, and the applied electric field, E, 
as shown in Figure 2 below. [Ref. 3] As the intensity of the electric field is 
increased, the polarization increases until saturation is reached at P s . If the 
electric field is subsequently removed, a remanent polarization, P r , remains. 
When the polarity of the electric field is reversed, similar characteristics but 
of opposite polarity are exhibited. The two zero-field values of remanent 
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polarization, ±P r , are equally stable and thus result in the ability to provide 
nonvolatile storage of binary information. 




Figure 2. Polarization versus Applied Electric Field [Ref. 4] 
b. Fatigue and Ageing 

Ferroelectric devices are affected by two primary forms of 
functional degradation: fatigue and ageing. Standard definitions of these 
terms have not yet been established, so working definitions for the purpose 
of this discussion will be described below. 

Fatigue is defined as the symmetric loss in remanent 
polarization that results from repeated application of electric fields [Ref. 4]. 
The fatiguing effect results in vertical compression of the hysteresis loop as 
shown in Figure 3. Periodic alternating electric fields are often intentionally 
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applied to ferroelectric materials to establish a measure of the material’s 
"fatigue limit" or the point at which the performance of the device is 
seriously degraded. 

Ageing is defined as the symmetric or asymmetric loss in 
remanent polarization that occurs under conditions of zero applied electric 
field following an initial polarization of the material [Ref. 4]. The original 
polarization levels may sometimes be restored by cycling the device through 
many polarization reversals by applying an alternating electric field [Ref. 5 J. 




Experiments to measure the effects of ageing usually consist 
of polarizing the device and waiting for a specified time before measuring 
the remanent polarization. Since the effects of fatiguing and ageing are 
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similar, tests to measure the effects of each phenomenon are usually 
conducted independently. 

c. Measuring Polarization 

Polarization, unlike voltage or current, cannot be measured 
directly. The Sawyer-Tower circuit shown in Figure 4 provides a simple 
method for the indirect measurement of polarization of ferroelectric 
capacitors [Ref. 6: p. 270, Figure 1]. The Sawyer-Tower circuit consists of 
an integrating or sense capacitor placed in series with the ferroelectric 
capacitor. The value of the sense capacitor, C s , is normally chosen to be 
four to five times the capacitance of the ferroelectric capacitor. 
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Figure 4. The Sawyer-Tower Circuit [Ref. 4: p. 19] 

The charge, q, on the upper plate of the sense capacitor, C s , 
(Figure 4) can be calculated from 

q = C S V 2 (1) 

where C s is the capacitance of the sense capacitor. Since this charge is 
equal and opposite to the charge on the lower plate of the ferroelectric 
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capacitor, the polarization, P, of the ferroelectric capacitor can be 
calculated from 




where A is the cross-sectional area of the ferroelectric capacitor. Thus, by 
combining equations (1) and (2), the polarization of the ferroelectric 
capacitor can easily be determined by measuring V 2 . l[Ref. 4: p. 20] 

Unfortunately, connecting measurement equipment to the 
Sawyer-Tower circuit will affect the charge distribution, thereby making the 
measurement invalid. This makes it impractical to determine the state of the 
ferroelectric capacitor statically as described above. Instead, a method 
involving the application of a "read pulse" to the Sawyer-Tower circuit is 
used. This method will be explained in detail in the discussion that follows. 

Independent of their ferroelectric effects, ferroelectric 
capacitors have the properties of standard dielectric capacitors. When an 
electric field is applied to the capacitor, a charging current flows that is 
proportional to the dielectric constant of the material. If the polarization of 
the ferroelectric capacitor before applying the electric field is in the same 
direction as the field, only this charging current will flow. 

If the ferroelectric capacitor was polarized opposite the 
electric field, a larger current flows that is the sum of the charging current 
of the capacitor and the switching current caused by reversing the polarity 
of the ferroelectric material. Thus the polarization state of the capacitor 
before application of the electric field can be determined by the amount of 
current flow through the capacitor when the field is applied. It should be 
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noted that the ferroelectric capacitor will be polarized in the direction of the 
applied field after the read operation. Therefore, similar to the operation of 
dynamic RAM, reading the state of the capacitor destroys the information 
stored in the capacitor. [Ref. 7: p. 213] 

Figure 5 shows the current through a ferroelectric capacitor 
for the four possible conditions. Note that the capacitor is polarized in the 
negative direction before the pulse train is applied. When voltage pulse P is 
applied, a polarization reversal is caused resulting in a larger current pulse. 
Pulse U causes no polarization reversal and only the smaller charging current 
flows as illustrated by curve U. 




Figure 5. Current Output for Ferroelectric Capacitor [Ref. 7: p. 213] 
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Similar results occur for the negative pulses as shown by 
curves N and D. If, due to fatigue or ageing, the ferroelectric capacitor is 
not fully polarized in a given direction, the current pulse will lie somewhere 
between the P and U or N and D curves. 

When such pulses are applied to a Sawyer-Tower circuit 
arranged as previously discussed, the sense capacitor will integrate the 
current pulse and the voltage V 2 (Figure 4) will be proportional to the area 
under the appropriate curve as shown in Figure 5. Thus by measuring the 
voltage across the sense capacitor, it is possible to determine the 
polarization state of the ferroelectric capacitor. A fixed reference direction 
(positive or negative) for all read pulses is normally chosen. 

It should be noted that the Sawyer-Tower circuit is used only 
for reading the polarization state of the ferroelectric capacitor. The sense 
capacitor should be switched out of the circuit when an electric field is 
applied to polarize the ferroelectric capacitor in a given direction. 
Additionally, the sense capacitor should be in a fully discharged state before 
being connected to the ferroelectric capacitor. Both requirements are easily 
met by simply grounding the sense node when polarizing or writing to the 
ferroelectric capacitor, and removing the ground when reading. 

3. The FERRO Experiment 

The objective of the FERRO experiment is to measure the fatigue 
and ageing response of integrated ferroelectric capacitors as they 
experience high levels of ionizing particle radiation. FERRO contains a total 
of 32 ferroelectric capacitors divided into four groups of eight referred to as 
devices under test (DUTs). Two DUTs will serve as the test group. They 
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will be located outside the shielding of the housing subsystem and receive 
the maximum radiation dose possible, the other two DUTs will serve as the 
control group and reside inside the shielding of the housing subsystem. 

Each group is further subdivided so that one DUT will undergo both fatigue 
and ageing tests, while the other DUT will go through only the ageing tests. 
The experiment is executed in 21 -day cycles as shown in Figure 6. The 
cycles will be repeated until the end of the experiment. 




Figure 6. FERRO Experiment Cycle 



a. Fatigue/Age Testing 

One DUT from each of the control and test groups will 
undergo a combination of fatigue and age testing. Three identical seven-day 
subcycles of fatigue/age tests will occur each experiment cycle. During the 
fatigue phase of testing, a 5 kHz, 10 volt peak to peak bipolar squarewave 
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will be applied to the DUTs with the sense capacitor of the Sawyer-Tower 
circuit switched out (sense node grounded). 

The fatigue phase will continue for six days with a short 
pause every 24 hours to polarize and then sample the remanent polarization 
of each ferroelectric capacitor using the Sawyer-Tower circuit. Two data 
points will be collected for each capacitor. First, a negative pulse is used to 
write to the ferroelectric capacitor, followed by a read using a positive 
pulse. This data point will provide a measure of the negative remanent 
polarization. Using opposite polarities for the read and write pulses ensures 
that polarization reversal will occur during the read process. For the second 
data point, the polarity of the read and write pulses are reversed to provide 
a measure of the positive remanent polarization. 

On the seventh day of each fatigue/age subcycle, the DUTs 
will undergo ageing tests that are identical to the ageing tests for the ageing 
DUTs described below, but limited to 24 hours in duration. The 24-hour 
period of ageing tests will allow for tests using the first 23 time intervals of 
Table 1 to be completed. 

b. Ageing Tests 

The other DUT in each of the control and test groups will 
undergo only ageing tests for the 21-day experiment cycle. Each ageing 
test will consist of writing to the ferroelectric capacitors and waiting a 
specified ageing time before reading the capacitors. The read and write 
pulses will be of opposite polarity, as in the fatigue testing, and the 
polarities will be reversed each experiment cycle. The ageing intervals for 
the 30 ageing tests done each experiment cycle are shown in table 1. 
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The cumulative time to complete all 30 ageing tests is 
approximately 20 days, 7 hours, but the ageing test cycle was rounded to 
21 days to keep the fatigue/ageing and ageing test cycles in 
synchronization. This also allows the test events to occur at fixed times in 
relation to the 24-hour clock. 

TABLE 1. AGEING INTERVALS (seconds) 
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c. Data Collection 

Each fatigue or ageing measurement will be an analog 
voltage that must be converted and stored in binary format. In addition to 
the ferroelectric capacitor measurements, internal and external temperature 
will be measured and recorded regularly. This data, along with other 
experiment status information will be uploaded to the APEX processor 
periodically. The APEX processor will collect data from all three 
experiments and relay the data to earth. Radiation dosimetry data will be 
provided along with the FERRO experiment data. 



13 



4. Intel M80C196KB Microcontroller 

The M80C196KB 16-bit microcontroller was chosen as the 
processor for the FERRO experiment. Details of the selection process are 
discussed in Reference 8. The M80C196KB is a highly integrated single 
chip device that incorporates many commonly used peripherals. The 
processor is a member of the CHMOS branch of the MCS-96 family and 
shares a common architecture and instruction set with other members in the 
family such as the 8096. The CHMOS devices have enhancements to 
provide higher performance at lower power consumption than the other 
devices in the family. 

A radiation-hard version of the processor is not available. While 
there is no data concerning radiation tolerance or single-event-upset rate for 
the chip, the fabrication process used by Intel for their military products has 
been shown to exhibit high total dose thresholds [Ref. 8: p. 59]. 

A simplified block diagram of the M80C196KB is shown in Figure 
7. The CPU has a register-register architecture and most operations can be 
quickly performed from or to any register. A 256-byte register space 
includes a 232-byte general-purpose register file that can be accessed as 
bytes, words (16 bits), or double-words (32 bits). Control of on-chip 
peripherals is accomplished through Special Function Registers (SFRs), 
which make up the balance of the register space. 

On-chip peripherals include a full duplex serial port, an A/D 
converter, a pulse-width-modulator, up to 48 I/O lines (depending upon 
which peripherals are used), a high-speed I/O subsystem, two timers, and a 
watchdog timer. 
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Figure 7. 80C196KB Block Diagram [Ref. 9: p. 4-1] 
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The 80C196KB has an addressable memory space of 64 Kbytes. 
The 256 bytes from 0000H through OOFFH are used for the SFRs and 
register file, while the locations between 2000H and 2080H are reserved for 
interrupt vectors and a chip configuration byte. A pin that is asserted on 
instruction fetches is provided to allow decoding of more than 64 Kbytes of 
addressing space. If used, this signal will allow for 64 Kbytes of code space 
and 64 Kbytes of data space. 

The 80C196KB can be runtime configured to operate with either a 
16-bit or 8-bit data bus. For 16-bit bus cycles, Ports 3 and 4 contain the 
address multiplexed with data. For 8-bit bus cycles, Port 3 is multiplexed 
with address and data, while Port 4 contains only the most significant byte 
of address. The bus width can be changed every bus cycle. Several modes 
of bus control are available to match a wide variety of external peripherals. 
This versatility reduces the external interface circuitry required. 

Additionally, the 80C196KB supports a bus exchange protocol to allow 
other devices to gain and return control of the bus. 
a. Timers 

Two 16-bit timers are available on the 80C196KB. Timerl is 
a free-running timer that is incremented every eight state times (sixteen 
system clock periods). Timerl may be used as a reference for both the HSI 
and HSO units. An interrupt can be generated when the timer overflows. 

Timer2 counts both positive and negative transitions on its 
selected input. It can be configured as either an up counter or down 
counter. Timer2 can be reset by hardware, software, or the HSO unit. 

Either Timerl or Timer2 may be used as a reference for the HSO unit. The 
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maximum transition speed is once per state time in Fast Increment mode 
and once every eight states otherwise. The value of Timer2 may be 
captured into a designated register by a rising edge on an external pin. An 
interrupt can be generated by the capture operation. Interrupts can also be 
generated by crossing either the OFFFFH/OOOOH boundary or the 
7FFFH/8000H boundary in either direction. 
b. High Speed Input Unit 

The High Speed Input (HSI) unit, shown in Figure 8, can 
capture the Timerl value when an event occurs on one of four input pins. 
Four types of events may be specified: rising edge, falling edge, rising or 
falling edge, or every eighth rising edge. A FIFO and holding register allow 
up to eight events to be recorded before they must be read. The HSI unit 
can generate interrupts in three ways: when a value moves into the holding 
register (i.e. data is available), when four events have been recorded, or 
when six events have been recorded. 




Figure 8. High Speed Input Unit Block Diagram [Ref. 9] 
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c. High Speed Output Unit 

The High Speed Output (HSO) unit can schedule and 
generate events at specified times based on Timerl or Timer2. A block 
diagram of the HSO is shown in Figure 9. These events can be scheduled 
to occur once, or to be recurrent, with minimal CPU overhead. Up to eight 
pending events can be scheduled and stored in a Content Addressable 
Memory (CAM). One CAM register is compared with the timer values each 
state time. 




Figure 9. High Speed Output Unit Block Diagram [Ref. 9] 



One CAM register is checked each state time to determine if 
an event should be initiated. The minimum time resolution of the HSO is 
eight state times since all eight CAM registers must be checked. Events 
that may be scheduled include: starting an A/D conversion, resetting 
Timer2, setting four software timers, and switching six output lines. 
Interrupts can be generated by any of these events. 
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d. Serial Port 



The 80C196KB provides an onboard serial port with one 
synchronous mode and three full duplex asynchronous modes. Two of the 
asynchronous modes are designed for interprocessor communications. 
Double buffering is provided for both the transmitter and receiver. Baud 
rates are generated with an independent 15-bit counter based on either the 
system clock or the Timer2 clock. 

The serial port may generate one of three maskable 
interrupts: Transmit Interrupt (Tl), Receive Interrupt (Rl), or SERIAL. A 
SERIAL interrupt is generated on both transmit and receive cycles, while Tl 
and Rl are generated on transmit and receive respectively. 
e. A/D Converter 

The 80C196KB’s built-in A/D converter is shown in Figure 
10. It consists of an 8-channel multiplexer, a sample-and-hold circuit, and a 
10-bit successive approximation analog-to-digital converter. 

Any one of the eight analog input pins (shared with Port 0) 
can be sampled under the control of the A/D Command register. 

Additionally, the conversion process can be scheduled using the High Speed 
Output (HSO) unit. The result is a 10-bit binary representation of the ratio 
of the analog input voltage divided by the analog reference voltage, V R ^p. 

The conversion process can take either 91 or 158 state 
times depending upon whether a prescaler bit is used. The prescaler is 
necessary if higher clock speeds are used, to allow time for the comparator 
to settle during the conversion. An interrupt can be generated upon 
completion of the conversion process. 
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A 



Figure 10. Analog-to-Digital Converter Block Diagram [Ref. 9] 

/. Pulse Width Modulator 

The Pulse Width Modulator (PWM) generates a variable duty 
cycle pulse that repeats every 256 or 512 state times depending upon 
whether a pre-scaler (divide by 2) is enabled. A block diagram of the PWM 
circuit is shown in Figure 11. An 8-bit counter is incremented every state 
time. When the counter overflows, the output is set high, when it matches 
the PWM register, the output is set low. The duty cycle of the output 
waveform is determined by the value in the PWM register. Applications for 
the PWM include generating motor drive control signals and performing 
digital-to-analog conversion. 
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Figure 11. Pulse Width Modulator Block Diagram [Ref. 9] 



g. Watchdog Timer 

The Watchdog Timer allows for graceful recovery from a 
software fault. When enabled, the watchdog will initiate a hardware reset 
unless the timer is cleared by software before it overflows. The 16-bit timer 
is incremented every state time; thus the programmer must ensure that 
under normal operation, the watchdog timer is cleared at intervals not to 
exceed 64K state times. 

h. Interrupts 

The 80C196KB microprocessor has 28 sources of interrupts 
mapped onto 18 vectors. Table 2 shows the interrupts and their priorities 
with 15 being the highest priority and 0 the lowest. The interrupts are 
individually maskable with the exception of the Nonmaskable interrupt, the 
Unimplemented Opcode interrupt and the Trap interrupt. Interrupts may be 
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globally enabled or disabled by changing a flag in the Program Status Word. 
Several instructions are provided to control the state of this flag. 

TABLE 2. 80C 196KB INTERRUPT PRIORITIES [Ref. 8] 



Interrupt Number 


Source 


Priority 


INT 15 
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15 


INT 14 


HSI FIFO Full 


14 


INT 13 


EXTINT1 


13 


INT 12 


TIMER2 Overflow 


12 
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Rl 
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8 


SPECIAL 


Unimplemented Opcode 


N/A 


SPECIAL 


Trap 


N/A 


INT 07 


EXTINT 


7 


INT 06 


Serial Port 


6 


INT 05 


Software Timer 


5 


INT 04 


HSI Pin 0 


4 


INT 03 


HSO Output Pins 


3 


INT 02 


HSI Data Available 


2 


INT 01 


A/D Conversion Complete 


1 


INT 00 


Timer Overflow 


0 



When an interrupt is detected, the corresponding bit is set in 
one of two interrupt pending registers. Interrupts are processed after the 
instruction that is currently executing is completed (instructions are 
indivisible). If the interrupt signal does not occur prior to four state times 
before the end of the instruction, the interrupt will not be processed until 
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after the following instruction. The maximum interrupt latency, based on 
the longest instruction, is 61 state times. When the interrupt vector is 
taken, the appropriate bit is cleared in the interrupt pending register. 

5. FERRO Hardware 

The basic design for the FERRO experiment hardware is presented 
in Reference 8. Several changes have been made to the initial design and 
the updated schematic diagram is included as Appendix A. The major 
components of FERRO include the 80C196KB microcontroller, a 
Programmable Peripheral Interface, static Random Access Memory (RAM), 
Read Only Memory (ROM), temperature sensors, analog drivers, analog 
switches and multiplexers, and the ferroelectric capacitors (DUTs). Figure 
12 is a block diagram that shows the relationship between the major 
components. 




Figure 12. FERRO Experiment Block Diagram 
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a. Memory 

The microcontroller memory consists of 32 Kbytes of ROM 
and 8 Kbytes of static RAM. The ROM is used for program storage, while 
the RAM is used as a scratchpad and for temporary storage of status and 
experimental data. The ROM is mapped to the lower half of the memory 
space. A radiation-tolerant 32-Kbyte ROM chip was chosen for the 
experiment. The system RAM consists of a radiation hard silicon-on- 
sapphire 8-Kbyte static RAM chip. The chip select logic was modified from 
the original design to provide for more flexibility in adding memory devices. 
Up to four 8 Kbyte memory devices are allowed for above program memory. 

b. Communication 

The FERRO experiment will communicate with the APEX 
spacecraft processor using the 80C196KB serial port. A packet switching 
protocol will be used for APEX to send commands to FERRO and for FERRO 
to send status and experiment data to the spacecraft processor. The EIA 
RS-422 two-way differential hardware interface is used with no hardware 
handshake lines implemented. 

c. Programmable Peripheral Interface 

The Programmable Peripheral Interface (PPI) is used to 
extend the number of output pins available to control the analog switching 
and multiplexing circuitry. A radiation-hard version of the 82C55A is used 
which provides three 8-bit ports. The original design called for the input to 
the PPI to be provided from Port 1 on the 80C196KB. This would have 
required interface control signals to be generated by the microcontroller 
under software control. A memory-mapped interface to the PPI was chosen 
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instead. The memory-mapped interface requires memory decode logic to 
generate the chip select, but has no software overhead. 



d. Ferroelectric Capacitor Input Circuit 

The PWM and HSO circuits on the microcontroller generate 



pulses to fatigue, read, and write the ferroelectric capacitors. A block 
diagram illustrating the select circuitry for one of the four DUTs is shown 
below in Figure 13. Analog drivers provide isolation and provide for both 
positive and negative pulses. The PWM generates a continuous train of 
pulses for fatiguing. Switches are provided to either apply the fatigue 
pulses to the ferroelectric capacitors or to ground the input of the 
capacitors. Read and write pulses are generated by the HSO. Analog 
switches select the output of either noninverting or inverting amplifiers to 
apply positive or negative pulses. Fatigue pulses are applied to DUTs 1 and 
2 only, while read and write pulses are applied to all four DUTs. 



CYCLE 



FERHO 

CAPS 





Olh* 

DU1» 



Figure 13. Ferroelectric Capacitor Input Select Circuit 
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e. Ferroelectric Capacitor Output Circuit 

The analog voltage output from the individual Sawyer-Tower 
circuits associated with each ferroelectric capacitor is applied through a 
series of analog multiplexers to the analog-to-digital converter on the 
80C196KB. Figure 14 below shows a block diagram of the output circuit 
for a typical DUT. 




Figure 14. Ferroelectric Capacitor Read Circuit 

When enabled during a read operation, the Sawyer-Tower 
Select switches will remove the ground from the bottom of the ferroelectric 
capacitors and switch in the sense capacitors. When not enabled, the 
switches ground the bottom of the ferroelectric capacitors. In addition, the 
sense capacitors are removed from the circuit and discharged. The eight 
Sawyer-Tower circuits for each DUT are operated as a unit. 
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The outputs of the Sawyer-Tower circuits are applied to 
eight 4:1 analog multiplexers that select output signals from the proper 
DUT. An 8:1 analog multiplexer then selects the desired channel from the 
eight available inputs. It should be noted that only one channel of the 
analog-to-digital converter is needed to measure any of the 32 ferroelectric 
capacitors. 

The analog-to-digital converter on the 80C196KB can 
convert only positive input voltages. Since the output from the selected 
Sawyer-Tower circuit will be negative for negative read pulses, an inverting 
operational amplifier is switched in for these conversions. A noninverting 
buffer amplifier is selected for positive voltages. 

/. Temperature Sensors 

Four temperature sensing circuits are provided to monitor the 
ambient temperature of the DUTs during the experiment. Two thermistors 
are mounted adjacent to the external DUTs and two are mounted adjacent 
to the internal DUTs. Changes in the thermistor's resistance are sensed by 
an operational amplifier circuit that produces an output voltage proportional 
to the temperature of the thermistor. The circuits sense temperatures over 
a range of -40°C to +70°C with an accuracy of ±1°C. The output of the 
sensing circuit is applied through a buffer amplifier to the analog-to-digital 
converter on the 80C196KB. Each of the four sensing circuits have a 
dedicated channel on the analog-to-digital converter. 
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II. SOFTWARE REQUIREMENTS 



A. DESIGN GOALS 

The Intel 80C196KB microcontroller will perform all aspects of 
experiment control, data acquisition, and communication with the host 
satellite processor. The design of the FERRO system and experiment 
software should not only meet the specifications of the experiment; it 
should maximize the probability of the successful conduct of the experiment 
given the hardware design. To meet this overall objective, the following 
design goals for the FERRO software have been established in order of 
precedence: reliability, ease of maintenance, flexibility, small size, and 
speed. 

1. Reliability 

Since the experiment will be conducted in space, reliability of the 
software is of primary importance. It should be thoroughly tested and error- 
free before the experiment is delivered for spacecraft integration. Critical 
regions where interrupts could result in nondeterministic program behavior 
should be identified and accounted for. A conservative approach should be 
taken with respect to hardware timing constraints wherever possible. 

In addition to the reliability of the software itself, the reliability of 
the hardware components should be considered in the software design. 
Since the APEX spacecraft will be in a high-radiation orbit, the possibility of 
single-event-upsets (SEU) and hard faults must be considered and allowed 
for within the constraints of the selected hardware. The design of the 
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software should provide for fault detection and recovery and should allow 
for redundancy where possible. Cost and availability have limited the use of 
radiation-hard components, so the radiation-hard components that were 
chosen should be used for permanent storage or backup of data. 

2. Ease of Maintenance 

Both during the development cycle and after completion, it is 
important that the software be easy to maintain. The software design 
should allow for changes to be integrated efficiently and without introducing 
error. The software should be easily understood by follow-on programmers 
and engineers. 

To meet this goal, the design of the software should be kept 
simple and straightforward. Modular design and structured programming 
concepts should be used extensively. A high-level language should be used 
wherever possible. Documentation of the program should be thorough, 
clear, and concise. Constants and variables with descriptive names should 
be used to make the code easier to read and understand. Future expansion 
and changes in specifications and hardware should be anticipated and 
allowed for in the design where practical. 

3. Flexibility 

The software should give the ground crew as much flexibility as 
possible in controlling the experiment. The more options available to the 
ground crew, the more likely they will be able to adjust to the demands of 
unforeseen events and changes that may occur during the conduct of the 
experiment. The extent of the flexibility provided may ultimately be limited 
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by the hardware design, but this concept should be kept in mind throughout 
the design of the software. 

4. Size and Speed 

Size and speed are not overriding considerations in the software 
design for this experiment, but these attributes will be optimized when doing 
so does not compromise the other design goals. While this may not provide 
direct advantages, keeping the code small and fast may give rise to side 
benefits such as allowing for redundant code or a more flexible command 
structure. 

B. INITIALIZATION AND RECOVERY 

The FERRO software is responsible for initializing and configuring the 
80C196KB microcontroller and the onboard peripherals when the experiment 
is powered on. Externally, the 8255 Programmable Peripheral Interface 
must be initialized and the analog switches and multiplexers must be set to 
apply ground to the ferroelectric capacitors. Once initialized the program 
will stand by for commands from the spacecraft processor to start the 
experiment. 

Since the FERRO experiment is considered a noncritical load on the 
APEX spacecraft, it is possible that the experiment may be shut down for 
periods to conserve power. In this event, orderly shutdown and recovery 
procedures must be provided to allow the experiment to continue when 
power can be restored. Experiment state information and any data that has 
been collected should be sent to the spacecraft processor. 
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In the event of an unforeseen loss of power or in the case of a soft 
fault causing the watchdog timer to time out, the software should recover 
gracefully and wait for further commands. 

C. COMMUNICATION 

The FERRO experiment will communicate with the APEX spacecraft 
processor using the OX. 25 packet-switching protocol. The data will be 
transmitted as asynchronous bytes at a data rate of 9600 bits per second 
with one start bit, one stop bit, eight data bits and no parity. OX. 25 is 
based on the Motorola X.25 protocol and is fully described in Reference 10. 
Figure 15. below shows the packet structure. 



FLAG 


SIZE 


DESTINATION 


SOURCE 


CONTROL 


DATA 


CHECKSUM 



Figure 15. FERRO Packet Structure 

The flag is a single byte, 07EH, that signifies the start of the packet. If 
a flag character occurs as data within the packet, an extra flag character 
will be inserted into the data stream as the packet is transmitted to serve as 
an escape sequence. When the packet is received, the extra flag character 
must be removed. Any single flag received in the packet following the first 
byte is an error and the packet must be ignored. 
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Multi-byte integers can be stored by computer systems in two ways. 
The values may be stored with the most significant byte (MSB) first (at a 
lower address) with the remaining bytes following in order of significance. 
This is referred to as big endian format. Another format, called little endian, 
stores the bytes in reverse order with the least significant byte first. In both 
cases the address of the first byte is used to refer to the value. 

Microprocessors normally use one of these formats. Values must be 
stored in the specified format to be operated on correctly by the processor. 
Values can be converted between the two formats by simply reversing the 
order of the bytes. 

The two-byte size field specifies the length of the data field. The field 
is stored using big endian format. The source and destination fields are 
two-byte codes specifying the source and destination addresses of the 
packet. If FERRO receives a packet with an address that does not match 
the FERRO address, the packet must be ignored. All packets sent by FERRO 
will have the APEX spacecraft address specified in the destination field. 

Only two bits of the two-byte control field are implemented for this 
experiment. The ACK request bit (bit 3) is set to request an 
acknowledgment packet in response to the command. The ACK response bit 
(bit 2) is set in the packet sent in response. All commands sent by the 
spacecraft processor will have the ACK request bit set and thus will require 
a response. 

The two-byte checksum field is used to detect errors that could occur 
during transmission. The checksum encoding and decoding algorithm is 
specified in Reference 10 and is presented below. 
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Assume: 



Len is the length of the packet. 

P is an array of length Len with elements numbered from O..Len-1 . 
CO and Cl are one-byte checksum accumulators. 



Encoding Algorithm: 

Initialize: 

P[Len-1 ) = PlLen-2] = 0; 
CO = Cl = 0; 

Compute: 

for i : = 0 to Len -1 do 
CO := CO + P[i); 

Cl := CO + Cl; 

Store results: 

P[Len-2] := CO - Cl; 
P[Len-1 ] := Cl - 2xC0 



Decoding Algorithm: 

Compute: 

for i : = 0 to Len -1 do 
CO : = CO + Ptil; 

Cl := CO + Cl; 

Result: 

Checksum is valid if both 
CO and Cl are zero. 



If an invalid checksum is received, the packet will be ignored. 

The spacecraft processor will initiate all communication in the form of 
commands to the FERRO processor. Commands will all have a four-byte 
data field with the first byte containing a code specifying the command. 

The remaining three bytes can contain supplementary data with any unused 
bytes set to zero. FERRO will respond either with a packet containing the 
requested data or with an acknowledgment packet. 

If the spacecraft processor does not receive a valid packet in response 
to a command, the command will be reissued. Transmission of the 
response packet must be completed within two seconds after FERRO 
receives the command or the spacecraft processor will assume the 
command will not be acknowledged. 
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D. ERROR DETECTION 



The FERRO experiment will be required to operate in a harsh 
environment over a long period. Use of the watchdog timer for detecting 
catastrophic errors will prevent the microcontroller from being locked in an 
infinite loop. In addition, methods for detecting more subtle errors are 
necessary to ensure the integrity of the data gathered. Both the program 
firmware and the experiment data buffers should be checked for errors 
periodically. In the case of a soft fault, recovery can be initiated and the 
experiment can continue. In the case of a hard fault, recovery may not be 
possible. 

E. EXPERIMENT CONTROL 

The experiment will be conducted under software control as modified 
by commands issued either from the ground or automatically by the 
spacecraft processor. The software will initiate and control the fatigue and 
ageing cycles of the experiment as defined in Table 1 and Figure 6. 
Ferroelectric capacitor, temperature and status data will be collected at 
appropriate times and sent to the spacecraft processor when commanded. 
The spacecraft processor will temporarily store the data and periodically 
downlink the data from all three experiments to the ground station. 

A real-time experiment clock will be maintained to act as a reference 
for experiment events and to time-tag data. The experiment clock will be 
referenced to the spacecraft universal time and will be synchronized to 
universal time periodically. 
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F. TEST/VERIFICATION 

A system to simulate the spacecraft processor will be required for 
testing during software development and for verifying the functional 
operation of the experiment at delivery. The system must be able to 
transmit all commands that can be issued by the spacecraft. It must also 
receive the responses from the experiment hardware. The responses will be 
displayed and evaluated for accuracy. The system should allow a 
permanent log of the testing to be saved for later analysis. 



35 



III. SOFTWARE IMPLEMENTATION 



The Intel iC-96 C compiler was chosen for development of the FERRO 
software. The compiler provides for easy and direct manipulation of the 
microcontroller's SFRs while maintaining the advantages of a high level 
language. A number of pragmas, or directives to the compiler, are available 
to give the programmer precise control over the resources offered by the 
80C196KB microcontroller. The compiler also supports in-line assembly 
language for use where speed is essential. Reference 1 1 gives a complete 
description of the compiler and relocatable linker. 

An IBM PC based development system with an 80C196 emulator was 
used for testing and debugging during software development. The emulator 
is discussed in Reference 12. A pod that plugged into the processor socket 
on the experiment prototype board allowed the emulator to interface with 
peripherals as they were added to the board. The system provides for 
emulation of both ROM and RAM. Features of the system include software 
breakpoints, single and multiple step operation, and easy access to SFRs 
and memory. 

Almost all variables are stored in RAM in order to take advantage of 
the radiation-hard component used. Only variables used in operations 
where time is a consideration are stored in registers. A compiler pragma is 
used to disable the storage of variables in registers except when explicitly 
declared. The source code for the FERRO experiment is included as 
Appendix B. The source was divided into several files by functional area for 
organizational purposes and to allow for changes to the code to be made 
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without recompiling the entire program. A make utility was used to aid in 
the compiling and linking of the source files. 



A. INITIALIZATION AND RECOVERY 

Initialization routines for the microcontroller and programmable 
peripheral interface are called immediately after the experiment is powered 
up. The 8255 is set to provide three 8-bit output ports for analog switching 
and multiplexer control. Initial values are sent to the ports to ground the 
ferroelectric capacitors. 

A compiler pragma statement sets the Chip Configuration Byte (CCB). 
The CCB is loaded into the Chip Configuration Register whenever the 
80C196KB is reset and on power up. For FERRO, the CCB is set for an 8- 
bit bus width and to use the Address Valid Strobe bus control signals. 

These settings were chosen to be compatible with peripherals used. 

The serial port is initialized to provide asynchronous communications at 
9600 bits per second. The baud rate is based on the system clock of 
4.9152 MHz. The value for the baud register can be calculated from the 
formula shown in equation (3). 



Baud Register = 



System Clock 
Baud Rate x 16 



(3) 



The most significant bit of the 16-bit baud register must be set to 
select the system clock as the reference. Substituting values into equation 
(3) and setting the MSB yields a value of 801 FH. The value must be loaded 
into the baud register as two sequential bytes, with the low byte loaded 
first. This method is obscurely described in one sentence of Reference 9 
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and was discovered only after several hours of frustration. Once the serial 
port is initialized, the receive (Rl) interrupt is unmasked and interrupts are 
enabled. 

The HSO Software Timer 0 is set to initiate an interrupt every 0.125 
seconds. The interrupts are used to update the real-time clock for the 
experiment. Timer 2 is the reference for the HSO commands that implement 
the real-time clock and an HSO command is used to reset the timer each 
time the interrupt is generated. These commands are all locked in the HSO 
CAM to produce the desired periodic interrupts without further processor 
overhead. 

The Timer 2 Clock input is derived from the CLKOUT pin of the 
80C196KB. The CLKOUT pin supplies a 50% duty cycle clock signal at 
one-half the system clock frequency. This signal is applied to a 4-bit 
counter (see Appendix A) that is used to divide the frequency by 16. The 
resulting frequency provides one transition every eight state times which is 
the maximum clock frequency that should be used as a reference for the 
HSO. 

Once initialization is complete, a wait loop is executed until the first 
command is received from the spacecraft. The watchdog timer is enabled 
and is reset each time the wait loop is executed. 

B. COMMUNICATION 

Packets carrying commands from the spacecraft processor will be 
processed by an interrupt driven routine. A flow diagram describing the 
algorithm to receive and validate the packet is shown in Figure 16. 
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SET STATE 
FALSE 





Figure 16. Receive Interrupt Flow Diagram 
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When the serial port receives a byte, the Rl interrupt flag is set and 
control is transferred to the receive interrupt service routine. For all 
interrupt routines, the compiler generates code that disables interrupts and 
pushes the PSW and interrupt mask registers on the stack. The interrupts 
are globally disabled and the interrupt mask registers are cleared. The 
programmer must explicitly re-enable interrupts if they are to be serviced 
during the interrupt routine. Interrupts are enabled upon exiting the 
interrupt routine when the PSW and mask registers are restored. 

The only interrupt, besides the receive interrupt, that the FERRO 
software uses is the software timer that updates the real-time clock. A 
decision was made not to enable interrupts during the receive interrupt 
processing due to the short time (approximately 0.2 msec average, 1 msec 
worst case) spent in the receive interrupt routine. 

Each call of the interrupt handler will process one byte of the packet. 
The serial port status register is checked each time for stop bit and overrun 
errors. The packet is immediately discarded if any error is indicated. Once 
the packet is discarded, the spacecraft processor must retransmit the entire 
packet. If no error is detected, the byte is retrieved from the serial buffer 
for further processing. 

The packet is assembled in a memory buffer as the individual bytes are 
received. An index is used to point to the next buffer location to be used. 
The index also indicates the position within the packet of the byte being 
processed. 

When the index is zero, indicating the start of the packet, the routine 
ignores any character other than a flag character. Once the flag is received, 
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it is stored in the buffer and the index is incremented. Flag characters 
occurring after the first byte must be processed to determine if they are part 
of a valid escape sequence. The escape sequence consists of two 
consecutive flag characters and is used to indicate the occurrence of a flag 
character within the body of a packet. 

A boolean variable, State, is used to detect the occurrence of an 
escape sequence. State is initialized to false. When a flag character is 
received in the body of a packet, State is set to true and the routine ends, 
awaiting the reception of the next byte. If the next byte is a flag, State is 
again inverted; a valid escape sequence has been detected and a single flag 
character is entered into the buffer. 

Receiving a character other than a flag when State is true indicates 
that a single flag has been encountered. When this occurs, it is assumed 
that the flag marks the start of a new packet. Any previously received data 
is discarded with the exception of the last two bytes: the flag and the byte 
that was just received. Since the byte just received is the second byte of 
the new packet, the index is set to point to the second location of the 
packet buffer and the byte is stored. 

When the second and third bytes of the packet have been received, 
the length of the packet can be calculated. As mentioned previously, the 
size field is stored in big endian format and thus must be converted to little 
endian format to be used by the 80C196KB processor. The overhead 
length, consisting of the sum of the header and checksum lengths, is added 
to the converted data field length to yield the total length of the packet. 
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This value is used to detect when the last byte of the packet has been 
received. Once the entire packet has been received, the destination field is 
checked to ensure that it matches FERRO's address and the checksum is 
validated. The packet is discarded if either check fails. If the packet is 
valid, the command byte (i.e., the first byte of the data field) is placed in the 
command list to be processed. The command list is a circular queue with 
space for up to three pending commands. 

Acknowledgment and data packets are transmitted to the spacecraft 
processor using a simple busy-wait loop that waits for the transmit-buffer- 
empty bit to be set in the serial port status register. If a flag character 
occurs within the body of the packet, a second flag is inserted in the data 
stream to indicate an escape sequence. The double-buffering feature of the 
serial port transmitter is used to transmit the second flag. The watchdog 
timer is reset after each byte is transmitted to ensure the timer does not 
overflow when long packets are transmitted. 

C. ERROR DETECTION 

The watchdog timer can detect catastrophic errors that cause a 
deviation from the normal program flow. During normal program operation, 
the software will reset the watchdog timer at intervals that will prevent the 
timer from overflowing. Any error that affects the program flow in a 
manner that prevents the reset from occurring within the normal timeframe 
will result in a reset of the 80C196KB microcontroller. 

After the processor is reset, the initialization phase will be conducted 
and the experiment will have to be restarted by a command from the ground 
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crew. If the error is not permanent in nature (i.e., due to an single-event- 
upset), the experiment can carry on with only a minor loss of data. A 
permanent fault may result in the same watchdog failure thereby precluding 
the continuation of the experiment. 

Errors that occur during communication are detected with the two-byte 
checksum as specified in the OX. 25 protocol. The checksum routines can 
also be used to detect errors that may occur during data collection. This 
feature was not ready in time to be integrated into the software for the 
experiment, but the method will be described here. 

A checksum of the data buffer is calculated and stored each time data 
is collected. Just prior to the next data collection event the checksum 
validation routine is called to ensure that the data in the buffer remains 
unchanged. If an error is detected, a flag is set and a time tag stored so 
that the data in question can be identified. Another option would have been 
to discard the questionable data by clearing the buffer, but keeping the data 
and allowing the decision to be made on the ground provides for more 
flexibility. 

D. EXPERIMENT CONTROL 

Once FERRO has started, the experiment will be conducted according 
to a preset schedule. Scheduled events will be initiated by the experiment 
control routines at specified times. FERRO's real-time clock will be the 
reference for all scheduled events. 

Overall control of the experiment will be accomplished by commands 
issued either by personnel on the ground or automatically by the spacecraft 
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processor. These commands will control the initiation and shutdown of the 
experiment, the downloading of experiment and status data from FERRO to 
the spacecraft processor, and will allow for limited testing of the FERRO 
hardware and software without signals being applied to the ferroelectric 
capacitors. Table 3 shows the FERRO commands. 



TABLE 3. FERRO COMMANDS [Ref. 1] 



Command 


Byte 1 


Byte 2 


Byte 3 


Byte 4 


Source 


Data Dump 


01 OH 


* 


+ 


* 


Spacecraft 


End Test Mode 


020H 


* 


* 


* 


Ground 


Initialize 


030H 


* 


* 


* 


Ground 


Restart 


040H 


Cycle 


Cycle Day 


* 


Ground 


Shutdown 


050H 


* 


+ 


* 


Ground 


SOH 


070H 


+ 


+ 


+ 


Spacecraft 


Test Mode 


090H 


* 


* 


+ 


Ground 


UTime 


OAOH 


* 


* 


* 


Ground/ 

Spacecraft 


1 st Parameter 


OFOH 


MSB 

Time Tag 


2nd Byte 
Time Tag 


* 


Ground/ 

Spacecraft 


2nd Parameter 


OFOH 


3rd Byte 
Time Tag 


LSB 

Time Tag 


* 


Ground/ 

Spacecraft 


* Indicates t 


iat FERRO will ignore these bytes. 



1. FERRO Commands 

The Initialize command is used to start the experiment and should 
be issued only once during the conduct of the experiment. An acknowledge 
packet is sent to the spacecraft processor and the command is removed 
from the command list. The Cycle and Cycleday variables are initialized to 
one and zero respectively. Cycle counts the number of 21 -day experiment 
cycles conducted; Cycleday indicates the day within the cycle. Setting 
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Cycle to zero allows the first day of the cycle to begin at midnight of the 
day the Initialize command is sent. 

The Initialize command must be followed immediately by a Utime 
command to set the real-time clock. Utime is really a sequence of three 
packets: the first specifies the Utime command, while two parameter 
packets are used to carry the time from the spacecraft. The time-tag value 
is defined as the number of seconds since January 1, 1980. The 32-bit 
value is sent in big endian format and thus must be converted. Only the 
number of seconds elapsed during the current day is needed by the 
experiment, so the excess is stripped using the modulus operation. The 
resulting value is used to set the real-time clock. 

The real-time clock is implemented as a double-word (32-bit) 
variable that is incremented each second. The clock value indicates the 
number of seconds that have elapsed for the current day. Software Timer 0 
is used to update the clock. Since the interrupt for this timer occurs at 
0.125 second intervals, a bit is shifted through a register to count eight 
interrupts before incrementing the clock. The clock is reset to zero each 
day at midnight. Cycle and Cycleday are also updated at that time. 

The Utime command is the only method to set the real-time clock. 
The command will be sent immediately following the Initiate and Restart 
commands to set the clock initially. In addition, the spacecraft processor 
will send the Utime command once every twenty-four hours to ensure the 
experiment clock remains synchronized with the spacecraft clock. When 
the clock is set, a critical region is established by globally disabling 



45 



interrupts before altering the value. This is necessary because it takes more 
than one instruction to store the double-word variable. 

The Restart command is similar to the Initiate command except 
that it is used in case the experiment was shut down or the processor was 
reset. The second and third bytes of the data field in the Restart packet 
contain values to set Cycle and Cycleday. The Restart command is issued 
by the ground crew who must determine where in the experiment cycle to 
restart the experiment. Again, the Utime command and two parameter 
packets must immediately follow to set the real-time clock. 

After either the Initialize or Restart command has been executed, 
control is passed to an experiment executive control routine that manages 
the conduct of the experiment. The routine consists of an infinite loop that 
checks if a command packet has been received or if a scheduled experiment 
event is due to occur. Additionally, the routine initiates collection of 
temperature data every 32 seconds. 

The Data Dump command is issued by the spacecraft processor 
once each day, two minutes before midnight. FERRO will respond by 
transmitting a packet containing the ferroelectric capacitor data collected 
during the day. As the polarization of the capacitors is measured according 
to the experiment schedule, the data is stored in a designated buffer where 
the data dump packet is assembled. 

Although the number of measurements each day varies, the 
length of the packet is fixed. Separate sub-fields for fatigue and ageing 
data are allocated within the data field. The size of each of the sub-fields is 
determined by the number of measurements accomplished during the first 
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day of an ageing cycle for either the fatigue or ageing DUTs; 23 reads of the 
16 capacitors requires 368 bytes. The cycle-number and cycle-day are 
included in the data dump packet to identify the data. 

The State of Health (SOH) command causes FERRO to respond 
with a packet containing experiment status and temperature data. The 
spacecraft processor will issue the SOH command once each minute. Data 
from the four temperature sensors is collected every 32 seconds and is 
stored the SOH packet buffer. 

A flag in the SOH packet is used to indicate when the experiment 
is in test mode. When the SOH command is received, a time tag is obtained 
by reading the value of the real-time clock. The value is converted to big 
endian format and transmitted with the packet. More significant status 
reporting was planned, but was not implemented in time to be tested. 

Commands to enter and exit test mode allow for limited testing of 
the FERRO hardware and software. While in test mode, all commands are 
received and acknowledged as they would be during normal operation, but 
signals are not applied to the DUTs. This capability allows both FERRO and 
the interface to the spacecraft to be tested without affecting the capacitors. 

The Shutdown command is used if power must be removed from 
FERRO after the experiment has started. When the command is received, 
FERRO responds by immediately transmitting an SOH packet followed by a 
Data Dump packet. After sending the packets, the real-time clock is 
disabled to prevent further experiment events from occurring and fatiguing 
of the ferroelectric capacitors is stopped. The experiment can be resumed 
after power is restored by issuing a Restart command. 



47 



2. FERRO Experiment Events 

A preset schedule of events is used to carry out the 21 -day 
experiment cycle that is described by Figure 6 and Table 1. Scheduled 
events include the initiation of a fatigue cycle, writing to and reading from 
DUTs for ageing, and taking measurements from DUTs after periods of 
fatiguing. These events are scheduled to occur during the appropriate day 
of the experiment cycle at a time relative to the real-time clock. 

When the real-time clock is updated, a list of times for events to 
occur during the present cycle-day is scanned and compared to the clock 
value. If a match is found, the event code is placed in a pending list. The 
experiment executive control routine will then cause the event to be 
executed. 

A fatigue cycle must be initiated at the beginning of each 21 -day 
experiment cycle and must be reinitiated following ageing of the fatigue 
DUTs. Fatiguing is started by enabling and configuring the PWM to produce 
the 5 kHz pulse train and setting the analog switches to route the signal to 
the appropriate DUTs. Fatiguing is stopped by disabling the PWM and 
disconnecting the DUTs. 

Fatiguing of the ferroelectric capacitors in the two fatigue DUTs 
will be stopped briefly each day, just before the Data Dump command is 
expected, to collect data. Two data points will be collected for each of the 
sixteen capacitors. First, a positive write pulse will be applied to the 
capacitors followed by a read operation using a negative read pulse. The 
sequence will then be repeated with reversed polarities. 
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The HSO unit is used to generate the read and write pulses and to 
schedule the A/D conversion process to occur during the read pulse. Both 
the read and write pulses are one millisecond in duration. The pulse length 
was chosen to ensure that the circuitry in the path to the A/D converter has 
ample time to settle before the line is sampled. The write pulse could be 
shortened considerably, but keeping the pulses the same length had no 
impact on the experiment timing. 

For reading the fatigue capacitors, the A/D conversion is 
scheduled to start 120 state times before the end of the read pulse. This 
ensures that the conversion process will be complete before the pulse ends. 
The A/D conversion is scheduled differently for the ageing read process and 
will be discussed below. After all of the capacitors have been read, the 
fatigue process is resumed. 

At the start of an ageing cycle, an initial write to the DUTs being 
aged must be performed. After the first ageing period, the capacitors will 
be read and the read operation will be immediately followed by a write 
operation to store the value for the next ageing period. This sequence will 
be repeated until the ageing cycle is complete. 

The read operation for ageing must be different from the one used 
for fatiguing because the capacitors in each DUT are connected internally on 
the input side. This, in conjunction with the design of the switching circuit, 
dictates that all eight capacitors in the DUT are subjected to any read and 
write pulses applied to the DUT. This does not impact the fatigue data 
collection since a write operation is performed immediately before each read 
operation. Each capacitor is written to and read from twice; thus 32 pulses 
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are applied to all eight capacitors in the DUT although only four are 
pertinent to each one. These few extra read and write pulses applied to the 
capacitors are insignificant compared to the number of fatigue pulses 
applied. 

The problem with using a separate read pulse for each capacitor 
for ageing measurements is that the read pulse for one capacitor will 
effectively act as a write pulse to the other capacitors in the DUT. These 
capacitors will be repolarized in the direction of the read pulse and thus the 
ageing data would be invalid for all but the first capacitor read. The 
polarization measured from these capacitors would be the result of the 
previous capacitor's read pulse rather than the write operation performed at 
the beginning of the ageing period. 

The solution to this problem is to apply a single read pulse to the 
DUT and conduct all eight A/D conversions in sequence during the pulse. 
The CAM is not large enough to schedule all eight A/D conversions, so only 
the first is scheduled and a busy-wait loop is used to conduct the remaining 
seven conversions in succession. 

E. TEST/VERIFICATION 

An IBM PC based software program designed to simulate the 
spacecraft processor was used for testing during FERRO hardware and 
software development and to verify the functional operation of FERRO when 
the experiment was delivered for integration to the spacecraft bus. The 
program uses the PC's RS-232 serial port for communication with FERRO 
via RS-232 to RS-422 level shifters. 
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The program was developed using the C compiler included with 
Borland C+ + . The compiler offers access to the operating system and PC 
BIOS calls necessary to directly control the serial interface. The integrated 
development environment offers a program editor, project manager, and 
source-level debugger. A windowing and menu library was used to provide 
a user-friendly interface for the program. The source code for the test and 
verification software is included as Appendix C. 

Pull down menus provide selections to set communication parameters 
including baud rate, number of data bits, parity, and number of stop bits. 
These parameters can be saved in a configuration file so that future 
sessions will default to the chosen setup. Other selections initialize or reset 
the serial communication port, allow recording of all communications in a 
log file, and send command packets to the FERRO experiment. 

All FERRO commands can be sent by the software and prompts are 
provided for the user to supply data for the Parameter packets when setting 
the real-time clock. The outgoing packet is displayed in one window and 
the response from FERRO is displayed in another. The packet is parsed and 
labeled for display so that the packet header, data field, and checksum can 
be distinguished. The status of the checksum validation is displayed 
following the checksum field. 

A record of all communication between FERRO and the test/verification 
software can be saved in a log file. A menu selection toggles the logging 
feature on or off. The user can select a file name for the log file or use the 
default file name. 
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IV. CONCLUSIONS AND RECOMMENDATIONS 



Several goals set at the beginning of software development were only 
partially met. The most significant shortfall was in the area of error 
detection. Additionally, a complete test of the FERRO software on the 
experiment hardware was not completed prior to delivery of the experiment. 

When software development for FERRO began, the specifications for 
the communication interface between the experiment and the spacecraft 
processor were immature in several areas including the command structure, 
universal time format, and use of the control field. Software development 
had to proceed before these specifications could be firmed up to meet the 
schedule for delivery of the experiment. 

Additionally, several specifications including the length of the size, 
source, and destination fields were changed well into the software 
development cycle. These factors resulted in extensive changes to routines 
that were already functional and tested. A significant amount of time was 
spent making these changes and debugging the inevitable errors introduced 
by the changes. As a result, several planned features were not 
implemented in the FERRO software. It ultimately became more important 
to get something that worked out the door rather than add and test 
additional features. 

A method for performing checksum validation of program memory and 
the data collection buffers periodically would ensure that SEUs and hard 
faults caused by radiation exposure do not go undetected. This error 
checking in conjunction with storing multiple copies of the program code in 
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ROM would allow the experiment to suffer multiple faults and still be able to 
complete the mission. 

The checksum validation routine used for communication was designed 
so that it could also be used to check either program memory or the data 
collection buffers. The proposed method for checking the data buffers was 
discussed earlier. To implement error checking for the program code, a 
checksum for a specified area of program memory would have to be 
calculated off line and stored in ROM at the end of the program code. 
Periodically, the checksum validation routine would be called to validate the 
program memory. 

If an error was detected, a flag would be set and a system reset 
conducted. The program start-up code would recognize the flag (registers 
are not cleared by a reset) and would call a different copy of the experiment 
software. There would be areas of the software that could not be 
duplicated (i.e., the start-up code), but this type of error checking and 
recovery mechanism could significantly increase reliability of the experiment 
software. 

Another area that could be improved is the command interface. The 
command structure evolved through the many specification changes and the 
result is not as clean and efficient as originally envisioned. One possible 
improvement would be to implement the command decision tree with a state 
matrix. Rather than ignoring illegal commands, a flag could be set in the 
acknowledge packet so that the that the spacecraft processor would not 
simply retransmit the command. More status and mode information should 
be included in the SOH packet. Additional information could be used by 
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ground personnel to take appropriate corrective action should problems 
occur. 

Finally, the format of the data packet could be improved to make it 
easier to extract and reconstruct the experiment data to conduct analysis. 
A variable length data packet with tag or label fields for each group of 
capacitor data would be more efficient and would make it easier to 
positively identify the data. 
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APPENDIX A - FERRO EXPERIMENT HARDWARE SCHEMATIC 



This appendix contains the schematic for the FERRO hardware. The 
80C196KB Microcontroller and the 82C55 Programmable Periperheral 
Interface are shown on sheet 1. Also shown on sheet 1 is the chip select 
logic, the clock circuitry and the A/D converter input multiplexor for reading 
the ferroelectric capacitors. 

Sheet 2 shows the driver amplifiers and switching for applying read, 
write, and fatigue pulses to the capacitors. The sense capacitors and 
Sawyer-Tower switches for DUTs 1 and 2 are also shown. 

Sheet 3 shows the sense capacitors and Sawyer-Tower switches for 
DUTs 3 and 4. The temperature sensing circuitry is split between sheets 2 
and 3 as are the DUT select multiplexers for reading the ferroelectric 
capacitors. 
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APPENDIX B - FERRO SOFTWARE SOURCE CODE 



The source code for the FERRO software is divided in to several files 
based on functional area. FERRO. H contains all global definitions and 
macros and all function prototypes. All global variables are declared in 
GLOBALS.H. INIT96.C contains all of the initialization routines, while the 
bulk of the command and event processing routines are in COMMAND. C. 
The communication routines are located in PACKET.C and CHECK. C. 
EXPER.C contains all of the routines to read and write to the ferroelectric 
capacitors and read the temperature sensors. 
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This function sets each byte of the data packet to zero 
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extern SOHPKT soh_buf; 
extern unsigned long seconds 
TIME sohtime; 
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#pragma interrupt(rcv _packet=25) 
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rcv__ptr = 1; 

state = FALSE; /* single FLAG so resync */ 
rbuf [rcv_ptr++] = ch; /* must be new 2nd byte */ 
break; 
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APPENDIX C - TEST/VERIFICATION SOFTWARE SOURCE CODE 
The test and verification software consists of two header files and 
three source files. SERIAL. H contains all of the definitions and declarations 
necessary to initialize and use the RS-232 serial port on an IBM PC 
compatible computer. The routines for initializing and using the port for 
communication are located in SERIAL. C. 

TERM.H contains the definitions and declarations for the main portion 
of the test and verification software. Header files for the Ultra Windows 
library are included to provide definitions and declarations to support the 
library functions used to implement the user interface. Constants used to 
define the FERRO commands and packet structure are also defined here. 

TERM.C contains the routines that control and interact with the user 
interface. The routines to display menus and windows, and implement 
menu selections are also located in this file. The routines to send, receive 
and display packets are located in the file T_PACKET.C. 
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nt temp; 

f (portbese==0) return (-1); 

f (<Pantv<NO PARITY) I <Perity>ODDJ>ARITY)) return (-1); 
f ((Bits<$) IT (Bits>8)) return (-1); 
f ( (StopBi t<1 ) || (Stopflit>2)) return (-1); 
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/* Make status window */ 

un created, 24, 78, 24, NO BDR, WN NORMAL, status _ptr); 
wn color(BLUE, LIGHTGRAY, status_ptr); 
add window(status_ptr); 
wn_plst(0, 0, "Status:", status _ptr); 
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